[Bug 1794629] [NEW] CVE-2018-15473 - User enumeration vulnerability

[Alex Tomkins]

*** This bug is a security vulnerability ***

Public security bug reported:

https://nvd.nist.gov/vuln/detail/CVE-2018-15473

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to
not delaying bailout for an invalid authenticating user until after the
packet containing the request has been fully parsed, related to
auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Fixed in Debian: https://www.debian.org/security/2018/dsa-4280

Currently pending triage? https://people.canonical.com/~ubuntu-
security/cve/2018/CVE-2018-15473.html

** Affects: openssh (Ubuntu)
     Importance: Undecided
         Status: New

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-15473

** Information type changed from Private Security to Public

** Information type changed from Public to Public Security

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1794629

Title:
  CVE-2018-15473 - User enumeration vulnerability

Status in openssh package in Ubuntu:
  New

Bug description:
  https://nvd.nist.gov/vuln/detail/CVE-2018-15473

  OpenSSH through 7.7 is prone to a user enumeration vulnerability due
  to not delaying bailout for an invalid authenticating user until after
  the packet containing the request has been fully parsed, related to
  auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

  Fixed in Debian: https://www.debian.org/security/2018/dsa-4280

  Currently pending triage? https://people.canonical.com/~ubuntu-
  security/cve/2018/CVE-2018-15473.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1794629/+subscriptions